Privacy Policy

Last Updated: October 7, 2026 | Version 1.2

Cratify ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile apps, web app, website, and related services (collectively, the "Service").

1. Information We Collect

1.1 Information You Provide

• Account Information: Email address, display name, and profile photo when you create an account
• Inventory Data: Information about your locations, rooms, containers, and possessions including names, descriptions, categories, and photos
• User Content: Photos you upload for possession identification and container contents
• Communications: Feedback, support requests, and correspondence with us

Photos of receipts and documents may contain personal or financial information; and when others share content with you, or you add people (household members), we store that information as part of your account.

1.2 Information Collected Automatically

• Device Information: Device type and model, operating system and version, app version, language, and device identifiers
• Advertising Identifiers: On iPhone, your device's advertising identifier (IDFA), but only if you allow tracking when the app asks. On Android, your device's advertising ID. In both apps, an anonymous app ID created by Meta's software.
• Browser Information: On our website and web app, your IP address, browser type, the pages you visit, and cookies, including Meta's advertising cookies (_fbp and _fbc) when ad pixels are allowed to run
• How You Found Us: When you first arrive from a link, we note where it came from: the referring website's name (for example, google.com, not the page address), the campaign tags on the link (such as utm_source and utm_campaign), the ad network's name if the link came from an ad (not the ad's click ID), and the first page you opened. On Android, Google Play tells the app the same campaign information for the link you installed from, and if you tap a Google Play link on our website we add this information to that link so Play can pass it to the app. We use it only to learn which of our ads, posts, and partners bring people to Cratify, and we don't send it to ad platforms.
• Usage Data: Features used, actions taken, and interaction patterns
• Purchase Information: Which plan you bought or started a trial of, the price, and the currency. Payments are handled by Apple, Google, or Stripe.
• Crash Reports: Technical information about app crashes to improve stability

1.3 AI-Powered Features

When you use Cratify's AI features, the photos you capture are sent to Google's Vertex AI (Gemini) for processing.

• Used to identify your possessions, to detect multiple possessions in a single photo (Multi-Scan), and — for receipts and documents — to read the details visible in the image, which may include personal or financial information
• Processed by Google solely to provide these features, and not for advertising
• You can control whether your data is used to improve Cratify's AI features at any time in Privacy Settings (AI Training Opt-Out)
• Not shared with third parties for marketing purposes

1.4 Handmarks

A Handmark is a mark you draw or write on a container so you can find that container again by pointing your camera at it.

• What we store: the photo you take when you add a Handmark, and a set of numbers describing the mark's shape that our matching service works out from that photo. The Handmark photo also becomes the container's picture, so anyone you share that container with can see it.
• When you scan: the app sends only the square inside the on-screen frame, never the full camera view. It is compared on Cratify's own matching service, which runs on Google Cloud. Scans are not sent to Gemini or any other company, and never to advertisers.
• Scans we keep: most scans are compared and then discarded. We keep a scan only when it helps Cratify recognise the mark: the test scan when you add a Handmark, and scans where you pick the right container yourself, up to three per Handmark, with the newest replacing the oldest.
• Deleting: removing a Handmark or its container deletes its photos and shape data, and so does deleting your account.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Process and sync your inventory data across devices
• Enable AI-powered possession identification
• Send service-related notifications
• Respond to your inquiries and provide customer support
• Monitor and analyze usage patterns to improve user experience
• Measure whether our ads lead to sign-ups and purchases, and help ad platforms show our ads to people likely to find Cratify useful (see Section 3.1)
• Detect, prevent, and address technical issues and security threats

3. How We Share Your Information

We never sell your inventory, photos, receipts, documents, or household details, and we never share them with advertisers. We share personal information only in the ways below, including with AI apps you choose to connect (Section 4).

3.1 Advertising Partners

We advertise Cratify on Meta (Facebook and Instagram), OpenAI (ads in ChatGPT), Reddit, and Pinterest. To learn which ads lead to sign-ups and purchases, and to help those platforms show our ads to people likely to find Cratify useful, we share limited information with them. They can combine it with what they already know about you from other apps and websites. That's why California law may treat it as a "sale" of personal information or "sharing" for cross-context behavioral advertising, and why other states may call it "targeted advertising." You can opt out at any time (Section 3.3).

What they receive:

• Events: that you visited a page on our website or web app, installed or opened the app, created an account, started a trial, subscribed, or made a one-time purchase. For purchases, the plan, price, and currency. In our web app, OpenAI also learns that you added a possession or container or sent a share invite, but not what it was or who it went to.
• Identifiers: a scrambled (SHA-256 hashed) copy of your email address and of your Cratify account ID, plus event codes that include an internal account number so the same sign-up or purchase isn't counted twice. Hashing hides the original value, but ad platforms can still match it to an account you have with them, so it is not anonymous.
• Device and browser details: on our website and web app, your IP address, browser type, screen size, the address of the page, and the cookies Meta, Reddit, and Pinterest use to recognize your browser or the ad you clicked. In the apps, your app version, operating system version, device model (Android), language, Meta's anonymous app ID, and your advertising identifier (on iPhone, only if you allow tracking).

What they never receive: what's in your inventory. That means no possession names or descriptions, photos, receipts, documents, rooms, locations, notes, or information about the people in your household.

This covers advertising only. If you connect ChatGPT or another AI app to your account yourself, that app can receive your inventory information when it calls Cratify on your behalf, as described in Section 4.

When it happens:

• Our website (thecratesapp.com): Meta, OpenAI, and Reddit ad pixels load when you visit a page, and if you arrive from a Pinterest ad we keep Pinterest's click ID in a cookie, unless your browser sends a Global Privacy Control signal. They don't run on share-invite or account email-link pages.
• Our web app: before you sign in, the same as our website. Once you're signed in, nothing is sent until we've confirmed your Do Not Sell or Share setting is off.
• Our iPhone and Android apps: nothing starts until you've signed in, accepted our Terms and this policy, and your Do Not Sell or Share setting is off. On iPhone, we also wait for your answer to Apple's tracking prompt.
• From our servers: when you create an account (once) and when you first subscribe, start a trial, or make a one-time purchase, our servers send that event directly to Meta, OpenAI, Reddit, and Pinterest, after checking your Do Not Sell or Share setting. For sign-ups in the iPhone app and App Store purchases, this only happens if you allowed tracking.

Each ad platform handles this information under its own privacy policy: Meta, OpenAI, Reddit, and Pinterest.

3.2 Other Ways We Share

• People you share with: Cratify lets you share a location or a container with others — by sending a share link, inviting someone by email, or sharing with a person you've added. People you share with can view the possessions in what you shared, and if you grant edit access, modify them. When someone accepts, they join your household. Share links are single-use and expire; you can revoke access at any time, and we notify you which account joined when a share is accepted.
• Service Providers: Companies that run parts of Cratify for us and may use your information only to do that: Google (hosting, database, storage, sign-in, AI identification, and app analytics through Google Analytics for Firebase), RevenueCat (subscriptions and purchases), Apple, Google Play, and Stripe (payments), Sentry (crash reports), Resend (email delivery), and HeyCatch (product analytics, built on PostHog). HeyCatch receives the pages and screens you open, what you tap or click (not the text on it), your device and browser type, and your account ID and plan, never your inventory. You can turn it off with the Analytics & Usage setting in Privacy Settings. RevenueCat receives your account ID, email, name, purchase history, and how you found us (Section 1.2), and on Android, or on iPhone if you allow tracking, your advertising identifier. If you installed our iPhone app from an Apple Search Ads ad, Apple tells RevenueCat which of our campaigns it came from.
• AI apps you connect: If you connect Claude, ChatGPT, or another AI app to your account, it receives your information when it calls Cratify on your behalf and handles it under its own privacy policy. Inventory someone shares with you can be seen by AI apps you connect, and inventory you share with others can be seen by AI apps they connect. See Section 4.
• Legal Requirements: When required by law or to protect our rights and safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize sharing

3.3 How to Turn Off Ad Sharing

• Do Not Sell or Share setting: In the app or web app, go to Account → Privacy Settings and turn on Do Not Sell or Share My Data. It takes effect right away: the ad pixels and Meta's app software stop, and our servers stop sending your events and stop using any ad identifiers we stored for you. Anyone can use this setting, wherever you live.
• Global Privacy Control: If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of selling and sharing for that browser, and our website and web app won't load ad pixels.
• Apple's tracking prompt (iPhone): If you choose "Ask App Not to Track," we don't collect your advertising identifier, and we don't send your iPhone sign-up or App Store purchases to ad platforms. Meta's app software still records that the app was installed and opened, marked for limited use and without your advertising identifier. To stop that as well, turn on Do Not Sell or Share.
• Android advertising ID: You can reset or delete your advertising ID in your Android device settings.
• Email us: You can also ask us to opt you out at privacy@thecratesapp.com.

Opting out stops sharing from then on. It doesn't pull back information ad platforms already received, and you may still see ads for Cratify.

4. Using Cratify with AI Apps

4.1 Connecting an AI App

You can choose to connect Claude (by Anthropic), ChatGPT (by OpenAI), or another AI app to your Cratify account. A connection is made only when you sign in to Cratify and select Allow. You can see and manage your connections in Account → Manage connections.

A connected AI app receives information from your account only when it calls Cratify on your behalf. It handles what it receives under its own privacy policy and retention practices, including whether it uses that information to train AI models. Cratify's AI Training Opt-Out setting (Section 1.3) doesn't control the AI app.

These are disclosures you direct. They are not a sale of your personal information or "sharing" for cross-context behavioral advertising under California law (CCPA/CPRA). The AI provider receives the information as an independent business (a "controller" under the GDPR).

4.2 What the AI App Can Receive

• Possessions: name, description, quantity, category, tags, flags such as fragile or valuable, amounts you recorded (such as receipt totals or warranty cost), dates, and barcode.
• Locations, rooms, and containers: names, descriptions, label phrases, and QR code links.
• Receipts and documents: the receipt, warranty, insurance, lease, passport, and other document details you entered. Passport document numbers and insurance policy numbers are shown only as their last 4 characters, and lease property addresses are not shared.
• Photos: photos of your possessions, when the AI app asks to see them. We remove location and other metadata from each photo first, but a photo can show whatever is in it. Photos of documents are never shared.
• People and households: the people you track (their names, their relationship to you, and whether each is a child, a pet, or other), your households (names and members), who each possession belongs to, and your collections with their checklists.
• Sharing: the names and email addresses of people you share with and people you've invited, and the name of anyone who has shared inventory with you.
• Shared inventory: inventory that other people share with you is available to AI apps you connect. In the same way, inventory you share with other people is available to AI apps they connect.

4.3 What the AI App Never Receives

• Possessions and containers you've hidden, and everything inside them
• Possessions that AI identification is still processing (drafts)
• The street addresses of your locations
• Share-invite links and tokens
• Your password

Anything you type into notes or descriptions is shared as written.

4.4 What the AI App Can Do for You

When you ask it to, a connected AI app can:

• Add, edit, and move your possessions, containers, rooms, and locations; add photos; and add or edit the people you track and your collections.
• Delete possessions, containers, rooms, locations, or photos, but only after showing you a preview of what will be deleted and asking you to confirm.
• Send share invitations by email, from Cratify in your name, stop sharing, and cancel invitations, but only after asking you to confirm. It can send up to 20 invitations a day.

Actions a connected AI app takes for you are your actions.

4.5 What We Keep

• Connection record: which AI app you connected, when, and the permissions you granted. We keep it for up to 2 years and delete it when you delete your account.
• Access tokens: the tokens that let the AI app reach your account, stored only in hashed form.
• Confirmation codes and upload links: one-time confirmation codes expire after 10 minutes and photo-upload links after 30 minutes; both are then deleted automatically.
• Request logs: for each call an AI app makes to Cratify, your account ID, the tool it used, whether the call succeeded, and how long it took. The logs don't record the content.

4.6 Disconnecting

You can disconnect an AI app at any time in Account → Manage connections, and its access stops within a minute. You can also disconnect from inside the AI app. Deleting your Cratify account ends every connection and deletes the related records.

Disconnecting stops future access. It doesn't delete information the AI app already received; you manage that with the AI provider.

5. Data Storage and Security

Your data is stored securely using industry-standard practices:

• Data is stored on Google Cloud Platform (Firebase) infrastructure
• All data is encrypted in transit using TLS/SSL
• Photos are stored in secure cloud storage with access controls
• We implement authentication and authorization to protect your account

6. Your Rights and Choices

6.1 Access and Export

You can access all your data within the app and request an export of your data at any time.

6.2 Deletion

You can delete your account and all associated data through the app settings. This will permanently remove:

• Your account information
• All locations, rooms, containers, and possessions
• All uploaded photos
• Usage history and preferences
• The ad identifiers and browser details we stored for ad measurement

Deleting your account doesn't delete information ad platforms already received from us; that is covered by their own privacy policies (Section 3.1).

6.3 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect about you, and how we use and share it
• Request deletion of your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of your personal information (Section 3.3)
• Not be discriminated against for exercising these rights

In the past 12 months, we have sold or shared (as California law defines those terms) the following categories of personal information with advertising platforms (Meta, OpenAI, Reddit, and Pinterest), for advertising and ad measurement:

• Identifiers: hashed email address, account IDs, advertising identifiers, cookie IDs, and IP address
• Commercial information: sign-ups, trials, and purchases, with plan, price, and currency
• Internet or other electronic network activity: pages visited on our website and web app, app installs and opens, and the in-app events described in Section 3.1

We don't sell or share sensitive personal information, and we don't knowingly sell or share the personal information of anyone under 16. To exercise these rights, visit Privacy Settings in the app or contact us.

6.4 Residents of Other U.S. States

Some other states give you the right to opt out of targeted advertising and the sale of personal information. The Do Not Sell or Share setting and Global Privacy Control work the same way for you (Section 3.3).

6.5 European Residents (GDPR)

If you are in the European Economic Area, you have additional rights including:

• Right to access, correct, or delete your data
• Right to data portability
• Right to restrict or object to processing, including our use of your information for ad measurement
• Right to withdraw consent

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. We keep the ad identifiers and browser details we store for ad measurement until you delete your account, use browser details for no more than 7 days after we receive them, and stop using any of them once you turn on Do Not Sell or Share. After account deletion, we may retain anonymized data for analytics purposes. Backup copies may persist for up to 30 days after deletion.

8. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy in the app and updating the "Last Updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

10. Contact Us